wolf480pl/phpass

Java PHPass hash implementation

phpass's Issues

There is no license.

If you intend this code to be used by other you need to include a license giving others permission to use your software and explaining the terms for use. Right now the only way anyone can legally use your code is to get written permission from you. (At least, that's how copyright law works in the US).

Consider including a MIT license with your PHPass implementation; I notice you've use the MIT license on some of your other projects.

Convert existing encoded credential to Bcrypt?

Hello,

I have a number of encoded passwords that look something like the following (representative example from WordPress):

    $P$BMYJOjzPjlG031l1/fjc938A88RsFi/

Could your library be used to convert the existing encoded passwords to an encoding via Bcrypt?  

For completeness, I am using your library and the following to generate hashed passwords now:

    PHPass pw = new PHPass(8);
    String hpw = pw.HashPassword("FOOBAR");

Please advise, and thank you.

Best regards,

rehmke

UTF-8 Conversion Problem

Hi,

we are having a problem with PHPass.java.

OS : Ubuntu linux 1204
Java: Java(TM) SE Runtime Environment (build 1.6.0_45-b06)
Java HotSpot(TM) 64-Bit Server VM (build 20.45-b01, mixed mode)

PHPass downloaded from: https://github.com/Wolf480pl/PHPass

Code generating problems:

import com.github.wolf480pl.phpass.PHPass;

public class test {

public static void main(String[] args) {
    try {
        while (true) {          
            System.out.println(md5crypt("goofy"));
        }
    }
    catch (Exception e) {
        e.printStackTrace();
    }
}

public static String md5crypt(String password) throws Exception {
    PHPass phPass = new PHPass(8);
    return phPass.HashPassword(password);
}   

}

Generated output:

$P$BUxyjxmaMlEPY9EdxTFzeogu/2Tazi.
....
many executions
....
$P$BjzPjnwyjsuuxw.Hd0sBM3uyfIrXma1
java.lang.ArrayIndexOutOfBoundsException: 5
at com.github.wolf480pl.phpass.PHPass.encode64(PHPass.java:66)
at com.github.wolf480pl.phpass.PHPass.gensaltPrivate(PHPass.java:118)
at com.github.wolf480pl.phpass.PHPass.HashPassword(PHPass.java:134)
at test.md5crypt(test.java:20)
at test.main(test.java:10)

The problem:

The problem seems to be in private byte[] stringToUtf8(String string); where you pass a String generated from an array of 6 random bytes to be converted using UTF-8, and you expect an array of at least 6 characters as result.

In many situations the returned array is less than 6 characters long.

According to this reference (http://en.wikipedia.org/wiki/UTF-8) there are many invalid characters for the UTF-8 conversion, but should be converted as more than one byte. This seems not to work.

Is this a bug of PHPass or are we making a mistake?

Thanks in advance.